CVE-2024-51558: 63moons Aero Auth Bypass Vulnerability

CVE-2024-51558 Overview

CVE-2024-51558 is a critical authentication vulnerability affecting 63moons Wave 2.0 and Aero applications. The vulnerability exists due to missing restrictions for excessive failed authentication attempts on the API-based login mechanism. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user credentials including OTP, MPIN, or password, potentially leading to unauthorized access and compromise of user accounts.

Critical Impact
Remote attackers can bypass authentication controls through unrestricted brute force attacks, enabling complete account takeover and unauthorized access to sensitive user data and financial transactions.

Affected Products

63moons Wave 2.0 (all versions)
63moons Aero (all versions)

Discovery Timeline

2024-11-04 - CVE-2024-51558 published to NVD
2024-11-08 - Last updated in NVD database

Technical Details for CVE-2024-51558

Vulnerability Analysis

This vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts). The Wave 2.0 application's API-based login endpoint fails to implement proper rate limiting or account lockout mechanisms, leaving authentication endpoints exposed to automated credential attacks.

The vulnerability allows network-based attacks without requiring any prior authentication or user interaction. Successful exploitation could result in complete compromise of user accounts, exposing confidential data, enabling unauthorized transactions, and potentially providing attackers with a foothold for further attacks against other user accounts within the system.

Root Cause

The root cause of this vulnerability is the absence of protective mechanisms to restrict repeated authentication attempts. The API login endpoint lacks:

Rate limiting controls to throttle authentication requests
Account lockout policies after a threshold of failed attempts
CAPTCHA or similar bot-detection mechanisms
Progressive delays between authentication attempts

Without these safeguards, attackers can submit unlimited authentication requests at high speed, making brute force attacks against OTP codes, MPINs, and passwords computationally feasible.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can target the API login endpoint and systematically attempt credential combinations:

The attacker identifies the authentication API endpoint for Wave 2.0 or Aero applications
Using automated tools, the attacker sends rapid authentication requests with different OTP, MPIN, or password values
Due to the lack of rate limiting, thousands of attempts can be made in seconds
Once valid credentials are discovered, the attacker gains unauthorized access to the victim's account

Given the limited keyspace of OTP and MPIN values (typically 4-6 digits), brute force attacks can succeed within minutes without proper rate limiting controls. For additional technical details, refer to the CERT-In Security Advisory CIVN-2024-0332.

Detection Methods for CVE-2024-51558

Indicators of Compromise

High volume of failed authentication attempts from single IP addresses or IP ranges targeting the API login endpoint
Unusual patterns in authentication logs showing sequential or systematic credential attempts
Successful login following a large number of failed attempts from the same source
Authentication requests originating from known malicious IP addresses or hosting providers commonly used for automated attacks

Detection Strategies

Implement monitoring rules to alert on authentication failure rates exceeding normal thresholds (e.g., more than 10 failures per minute from a single IP)
Deploy web application firewalls (WAF) with brute force detection capabilities
Enable logging of all authentication attempts including source IP, timestamp, and credential type (OTP/MPIN/password)
Correlate authentication logs with threat intelligence feeds to identify known attack sources

Monitoring Recommendations

Configure SIEM rules to detect and alert on brute force patterns targeting authentication endpoints
Monitor for unusual geographic patterns in login attempts that may indicate credential stuffing campaigns
Track successful authentications that follow abnormal failure patterns as potential indicators of successful account compromise
Establish baselines for normal authentication traffic and alert on significant deviations

How to Mitigate CVE-2024-51558

Immediate Actions Required

Implement rate limiting on all authentication API endpoints to restrict the number of attempts per IP address and user account
Deploy account lockout mechanisms that temporarily disable accounts after a configurable number of failed authentication attempts
Add CAPTCHA challenges after a threshold of failed login attempts to prevent automated attacks
Consider implementing multi-factor authentication with time-limited tokens and secure delivery channels

Patch Information

Organizations using 63moons Wave 2.0 and Aero applications should contact the vendor directly for security patches and updated versions that address this vulnerability. Refer to the CERT-In Security Advisory CIVN-2024-0332 for official guidance and any available remediation information from the vendor.

Workarounds

Deploy a web application firewall (WAF) with brute force protection rules in front of authentication endpoints as an interim mitigation
Implement IP-based rate limiting at the network level using firewall or load balancer configurations
Enable geographic restrictions to block authentication attempts from regions where legitimate users do not operate
Consider implementing additional out-of-band verification for sensitive operations until patches are applied

bash

# Example: Rate limiting configuration for nginx (interim mitigation)
# Add to nginx configuration for authentication endpoints
limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/m;

location /api/login {
    limit_req zone=auth_limit burst=3 nodelay;
    limit_req_status 429;
    # Additional proxy or application configuration
}